fixed HTML escaping